In order to improve the integration with OIDC IdPs the following changes might be implemented:
use configurable names for the supported IdPs. The IDP name is used by IM to make a call to keystone (path /OS-FEDERATION/identity_providers//protocols//...) and is passed by the Orchestrator in the authorization header (parameter username). The idp name should be provided in the CMDB (service record) as already implemented for the idp protocol name. A possible implementation is:
specify the name of the tenant to be used for the deployment when making the call to IM --> i.e. set the domain field in the authentication header (see https://imdocs.readthedocs.io/en/latest/client.html#auth-file). This is useful to avoid issues in case of users belonging to multiple projects.
In order to improve the integration with OIDC IdPs the following changes might be implemented:
use configurable names for the supported IdPs. The IDP name is used by IM to make a call to keystone (path /OS-FEDERATION/identity_providers//protocols//...) and is passed by the Orchestrator in the authorization header (parameter username). The idp name should be provided in the CMDB (service record) as already implemented for the idp protocol name. A possible implementation is:
specify the name of the tenant to be used for the deployment when making the call to IM --> i.e. set the
domainfield in the authentication header (see https://imdocs.readthedocs.io/en/latest/client.html#auth-file). This is useful to avoid issues in case of users belonging to multiple projects.